Split tunnel for User/Usergroup

[zsszlama]

Hello,

We have a request from our customer to implement split tunnel solution for certain user/users. Currently they have full tunnel remote access VPN.

I've found sk167000 (https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...) tested it also in lab environment and it works great. But it's only applicable for a VPN community.

Is it possible to implement split tunneling somehow for a user group?

Thanks in advance!

Zsolt

[the_rock]

I believe below is what you are looking for:

 Andy

[zsszlama]

I believe this option just defines which with authentication method can user authenticate on the VPN client.

[PhoneBoy]

Split tunneling is a global setting, unfortunately, so it applies to everyone.

[zsszlama]

That's what I thought. Thanks, PhoneBoy!

[JanVC]

route all traffic to gateway (yes/no/decide on endpoint)

make the default in the trac.default file to route all traffic to gateway, but tell specific users to manually untick the checkbox in their client?

[zsszlama]

Sounds good. May I ask for an SK or example from where I can learn and test it?

[JanVC · Accepted solution]

in the global properties you set the "route all traffic to gateway" to "configured on endpoint client" for oth the secureclient mobile and endpoint connect options

on the gateway object you tick the box for "allow vpn clients to route traffic through this gateway" and you configure the remote access encryption domain for the split vpn users

if the end user connects once to the gateway, the setting to route all traffic to gateway will no longer be greyed out and the user can freely choose between full tunnel or split tunnel

you could create a new vpn package one for full tunnel users and one for split tunnel users and install accordingly, that way you don't have to teach them about the setting

download the tool from sk122574

i believe you need the setting "neo_route_all_traffic_through_gateway"

[zsszlama]

Thanks Jan!

Meanwhile I've found sk114882. Based on that and your help it works for me in lab environment.

In addition to your settings I've modified the ttm files:

In the test group file:

:neo_route_all_traffic_through_gateway (

:gateway (endpoint_vpn_route_all_traffic_through_gateway

:default (client_decide)

)

In the trac_client_1 file:

:neo_route_all_traffic_through_gateway (

:gateway (endpoint_vpn_route_all_traffic_through_gateway

:valid (false)

:default (true)

)